Skip to content
Threat Feed
Subscribe

Product

Simple Email Service

2 briefs RSS
medium advisory

Detection of AWS SES Identity Verify-Use-Delete Abusive Pattern

Adversaries with unauthorized access to AWS Simple Email Service (SES) credentials may verify an attacker-controlled identity, send phishing or spam emails, and promptly delete the identity to evade detection and attribution.

Simple Email Service +2 cloud aws ses resource-development defense-evasion discovery credential-abuse
1r 3t updated
medium advisory

AWS SES Identity Deletion

Detection of an AWS Simple Email Service (SES) identity deletion event, potentially indicating an adversary attempting to cover their tracks after malicious activity.

Simple Email Service attack.stealth attack.t1070 cloud
2r 1t